The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2022-11-29T20:42:01.833Z

Updated: 2024-08-03T01:20:58.796Z

Reserved: 2022-11-08T16:35:49.165Z

Link: CVE-2022-3897

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-11-29T21:15:11.363

Modified: 2024-11-21T07:20:29.337

Link: CVE-2022-3897

cve-icon Redhat

No data.